Threats tagged 'ghsa-2pj2-4hfp-vxp8'

OpenSSL 4.0 has a use-after-free vulnerability triggered by concurrent decoding of the same X.509 certificate's extensions by multiple threads. This can cause a multi-threaded TLS client or server to crash, resulting in a denial of service. The issue arises because cached extension data is freed while still in use by another thread. Versions prior to 4.0.3 are affected, while earlier OpenSSL versions are not vulnerable.